Privacy Policy

Who is responsible for your data

The controller of your personal data is [YOUR FULL LEGAL NAME], trading as Shotward, [BUSINESS ADDRESS], United Kingdom (“we”, “us”). We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO REGISTRATION NUMBER].

For any privacy question or request, contact privacy@shotward.com.

Personal data we collect

Account and sign-in data

Your name and email address, and whether your email is verified. If you sign in with Google, we receive your name, email address, Google account identifier and, where available, your profile picture. We store single-use sign-in link tokens in hashed form.

Workspace and team data

Workspace names, membership and roles, invitations (including the invited email address), preferences, favourites and notifications.

Content

Images you upload, product details, prompts and creative briefs, generation settings, and the images and videos generated for you. Uploaded images are re-encoded when stored, which removes embedded metadata such as camera details and location data. Uploaded images can include people; please read the AI Output & Content Policy before uploading images of anyone.

Billing data

Your plan, subscription status, renewal date, credit balance and credit history, and a Stripe customer reference. Payments are handled by Stripe; we do not receive or store your full card number.

Communications

Messages you send us through the contact form (name, email, company, area of interest and message) or by email, and records of support requests and reports.

Technical, security and usage data

Information needed to keep the service secure and working, such as IP addresses used for rate limiting and abuse prevention, server logs, and session cookies. To enforce one trial per person, we keep a one-way hashed form of your email address, and short-lived hashed counters of sign-ups and sign-in link requests per email address and IP address. Error reports describe what went wrong, your browser and the page address without query strings; we remove request headers, cookies and request bodies before they are sent to our error-monitoring provider. Product analytics record the path of pages you view, together with standard technical information such as browser, device type and approximate location; see the Cookies & Analytics Policy.

How we use data and our lawful bases

AI processing and model training

To generate outputs, we send your uploaded images, selected references and prompts to our AI generation provider, fal.ai, which returns the generated image or video to us. This processing is necessary to provide the service you request.

We do not use your uploads, prompts or outputs to train AI models, and we do not sell your personal data. We do not look at your content except where needed to provide support you ask for, to investigate a report or suspected breach of our policies, or to comply with the law.

To keep the free trial fair, we automatically check whether an email address comes from a disposable email service, whether the same inbox has already claimed a trial (treating address variations such as plus tags as the same inbox), and how many trials have been claimed from the same IP address in a day. If these checks apply, your account is still created but may not receive trial credits. You can ask us to review the outcome by contacting support@shotward.com.

Who we share data with

We share personal data only with:

• service providers who process it on our behalf, listed on our Subprocessors page;
• other members of your workspace, who can see its projects, library and team details;
• Stripe and Google, which also act as independent controllers for some processing under their own privacy notices;
• professional advisers such as accountants and lawyers;
• law enforcement, regulators or others where we are legally required to, or where necessary to protect people from harm; and
• a company or other entity that we control, or a buyer of the Shotward business, if the business is transferred, in which case this policy will continue to protect your data.

International transfers

Some of our service providers store or process data outside the United Kingdom, including in the United States. Where a transfer is not covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified providers), we rely on the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses approved under UK law, together with any additional safeguards required. You can ask for more information about these safeguards at privacy@shotward.com.

How long we keep data

We keep personal data only for as long as we need it for the purposes above.

We may keep data for longer where needed to establish, exercise or defend legal claims, or where the law requires it.

How we protect data

We use encryption in transit, access controls, private file storage that is served through short-lived signed links, hashed sign-in tokens, and reputable infrastructure providers. No online service can be completely secure; if you discover a vulnerability, please follow the reporting process in our Support Policy. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.

Your rights and how to make a request

Under UK data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use your data;
• object to processing based on legitimate interests, including analytics;
• receive data you gave us in a portable format, where processing is based on contract or consent;
• withdraw consent at any time, where we rely on consent; and
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects.

These rights have some exceptions, for example where we must keep billing records by law.

Making a request

Email privacy@shotward.com, ideally from the email address on your account, and tell us which right you wish to exercise. We may ask for information to confirm your identity before acting. We will respond within one month of receiving your request, or of confirming your identity. If a request is complex or we receive several, we may extend this by up to two further months and will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive.

You can also download your outputs from the workspace at any time. Workspace owners can delete a workspace from Account after cancelling any subscription. To delete your account itself, email privacy@shotward.com.

If your data is in a workspace owned by someone else, we may need to involve the workspace owner, as they control that workspace’s content.

Complaints

Please contact us first so we can try to help. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113.

Children

Shotward is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account or that images of a child have been uploaded, contact support@shotward.com and we will act promptly.

Marketing

We do not currently send marketing emails. If we do in future, we will ask for your consent where the law requires it and include a simple way to unsubscribe in every message. Service emails, such as sign-in links and billing notices, are part of providing the service.

Changes to this policy

We will update this policy when our practices change. If changes are significant, we will tell you by email or in the service before they take effect. The “Last updated” date shows when this policy last changed.

Contact us